Security Prompts

# Solidity Smart Contract taste of a security-first protocol engineer
- Pin an exact recent compiler version with `pragma solidity 0.8.x;` instead of a floating caret range. Confidence: 0.90
- Build and test with Foundry, writing tests in Solidity, and keep Hardhat only where a plugin is truly needed. Confidence: 0.80
- Reuse audited OpenZeppelin contracts for tokens, access control and upgrades instead of hand-rolling standards. Confidence: 0.95
- Follow checks-effects-interactions in every function that makes external calls, and add a reentrancy guard where state is shared. Confidence: 0.95
- Use custom errors over revert strings for clearer failures and lower gas. Confidence: 0.85
- Emit an event for every state change that off-chain systems need to track, with indexed fields for common filters. Confidence: 0.85
- Prefer pull payments, where users withdraw funds, over pushing ETH to many addresses in a loop. Confidence: 0.90
- Never use `tx.origin` for authorization; check `msg.sender` against explicit roles. Confidence: 1.00
- Keep privileged roles behind a multisig and a timelock, and document every admin power in the README. Confidence: 0.90
- Avoid upgradeable proxies unless upgrades are a real requirement; when used, follow storage layout rules and test upgrades explicitly. Confidence: 0.80
- Use `SafeERC20` for token transfers so non-standard tokens that return no boolean do not break accounting. Confidence: 0.90
- Never trust a single spot price from an AMM pool; use time-weighted or decentralized oracles with staleness checks. Confidence: 0.90
- Bound every loop over user-controlled arrays to avoid gas-limit denial of service. Confidence: 0.90
- Write fuzz tests and stateful invariant tests for core accounting, not just example-based unit tests. Confidence: 0.90
- Run Slither and other static analyzers in CI, and treat new high-severity findings as merge blockers. Confidence: 0.85
- Mark functions `external` when they are not called internally, and make visibility explicit on every function and state variable. Confidence: 0.80
- Use `immutable` and `constant` for values fixed at deploy time to save gas and signal intent. Confidence: 0.85
- Document public functions with NatSpec comments describing parameters, return values and failure conditions. Confidence: 0.75
- Optimize gas only after correctness is proven, and never trade readability for micro-savings in security-critical paths. Confidence: 0.85
- Deploy with scripted, reproducible deployments, verify source on the block explorer, and record addresses per network in the repo. Confidence: 0.85
- Get an independent audit and run a bug bounty before holding meaningful user funds on mainnet. Confidence: 0.90

# Linux Server Hardening taste of a careful operations engineer
- Build servers from a minimal base image and install only the packages a role needs, removing compilers and debugging tools from production hosts. Confidence: 0.85
- Manage every server with configuration as code (Ansible, cloud-init or an image pipeline) and never rely on manual changes that drift. Confidence: 0.90
- Disable SSH password authentication and root login, and allow only key-based or certificate-based logins. Confidence: 0.95
- Prefer short-lived SSH certificates or an identity-aware access proxy over long-lived authorized_keys files copied around. Confidence: 0.75
- Give each engineer a named account with sudo through groups, and never share a common admin user. Confidence: 0.90
- Default the host firewall to deny inbound traffic and open only the ports the service actually listens on. Confidence: 0.90
- Keep SSH and admin interfaces off the public internet, reachable only through a VPN, bastion or private network. Confidence: 0.85
- Enable unattended security updates for the base OS, and schedule reboots so kernel patches actually take effect. Confidence: 0.85
- Run each service as its own unprivileged system user with no login shell. Confidence: 0.90
- Use systemd sandboxing options such as `ProtectSystem=strict`, `NoNewPrivileges=yes` and `PrivateTmp=yes` for every long-running service. Confidence: 0.80
- Keep SELinux or AppArmor in enforcing mode and write a policy exception instead of disabling it when something breaks. Confidence: 0.75
- Ship logs, including auth and audit logs, to a central store so an attacker on the host cannot erase the trail. Confidence: 0.90
- Enable `auditd` rules for privileged commands, changes to sudoers and edits under `/etc`. Confidence: 0.70
- Keep secrets out of files in the repo and on disk where possible; fetch them at runtime from a secrets manager with scoped access. Confidence: 0.85
- Mount `/tmp` and data volumes with `noexec`, `nosuid` and `nodev` wherever the workload allows it. Confidence: 0.65
- Apply sysctl hardening such as disabling IP forwarding and ICMP redirects on hosts that are not routers. Confidence: 0.70
- Rate-limit authentication attempts with fail2ban or the platform equivalent on any exposed login service. Confidence: 0.70
- Encrypt disks at rest and protect backups with separate credentials that the server itself cannot use to delete them. Confidence: 0.85
- Scan hosts regularly against a CIS benchmark or similar baseline and track findings like any other bug. Confidence: 0.75
- Prefer replacing a compromised or drifted server with a freshly built one over trying to clean it in place. Confidence: 0.90
- Keep accurate time with NTP or chrony on every host so logs, certificates and tokens line up. Confidence: 0.80

# Secrets Management taste of a security-minded platform engineer
- Never commit secrets to git, including in tests, examples or old branches; treat any secret that touched a repo as compromised and rotate it. Confidence: 1.00
- Run secret scanning (gitleaks, trufflehog or the platform's built-in scanner) as a pre-commit hook and in CI on every push. Confidence: 0.90
- Keep a committed `.env.example` with names and dummy values, and gitignore every real `.env` file. Confidence: 0.90
- Store production secrets in a dedicated manager such as Vault, AWS Secrets Manager, GCP Secret Manager or 1Password, never in wikis or chat. Confidence: 0.95
- Prefer short-lived, workload-issued credentials (OIDC federation, IAM roles, Vault dynamic secrets) over long-lived static keys. Confidence: 0.90
- Use OIDC from CI to cloud providers instead of storing cloud access keys as CI secrets. Confidence: 0.90
- Scope every credential to one service, one environment and the least privilege it needs. Confidence: 0.95
- Never share secrets between staging and production, so a leak in one cannot unlock the other. Confidence: 0.95
- Inject secrets at runtime through the platform (mounted files or environment variables) rather than baking them into images or build artifacts. Confidence: 0.90
- Prefer mounted secret files over environment variables for highly sensitive values, since env vars leak into crash dumps, child processes and debug pages. Confidence: 0.70
- Automate rotation on a schedule and design apps to reload credentials without a redeploy. Confidence: 0.80
- Support two valid versions of a secret during rotation so it can happen without downtime. Confidence: 0.80
- Redact secrets in logs, traces and error reports with explicit filters, and test that the redaction works. Confidence: 0.90
- Use envelope encryption with a KMS for application-level encryption keys and keep the key-encryption key out of the app. Confidence: 0.80
- Encrypt secrets that must live in git (for example GitOps manifests) with SOPS or Sealed Secrets, never as plain Kubernetes Secrets. Confidence: 0.85
- Audit-log every secret read and alert on unusual access patterns. Confidence: 0.75
- Maintain a written revoke-and-rotate runbook for each critical credential so a leak response takes minutes, not days. Confidence: 0.85
- Give humans access through SSO and time-limited elevation instead of shared admin passwords. Confidence: 0.90
- Validate required secrets at startup and fail fast with a clear message that names the missing key but never prints its value. Confidence: 0.85
- Do not roll your own encryption or token formats; use well-reviewed libraries and the provider's primitives. Confidence: 0.95